300-410 Practice Exam 65 — 20 Questions

Question 1

A multi-router network uses PBR to steer traffic from subnet 172.16.1.0/24 through a WAN link (next-hop 10.10.10.2). After a routing change, traffic from this subnet is being dropped. Router R1 shows: 'show route-map' indicates the route-map is applied, 'show ip policy' shows the policy on the interface, but 'debug ip policy' shows 'PBR: no route to next-hop 10.10.10.2'. What is the root cause?

Accepted Answer

The next-hop 10.10.10.2 is not reachable, and PBR drops packets when no route to the next-hop exists. Configure a fallback route or use 'set ip default next-hop'.. PBR requires the next-hop to be reachable via a route in the routing table. If the next-hop is not reachable (e.g., due to a routing change or a missing route), PBR will drop the packet unless a fallback is configured. In this case, the next-hop 10.10.10.2 is not reachable, so PBR drops the traffic. The solution is to either ensure the next-hop is reachable or configure a default route or fallback action.

Answer

The ACL in the route-map is incorrectly denying traffic from 172.16.1.0/24, causing PBR to not match the traffic.

Answer

The interface where PBR is applied is in a different VRF, causing the next-hop to be unreachable.

Answer

The next-hop 10.10.10.2 is reachable but the route-map has a 'match ip address' that is too specific, excluding some traffic.

Question 2

A network uses PBR to route traffic from a specific VLAN (10.10.10.0/24) through a firewall (next-hop 192.168.1.1). After a firewall replacement, traffic from this VLAN is being dropped. Router R1 shows: 'show route-map' shows the route-map is applied, 'show ip policy' shows the policy on the VLAN interface, but 'debug ip packet' shows packets being sent to 192.168.1.1 and no response. Router R2 (firewall) shows: 'show ip route 10.10.10.0' returns a route via 192.168.2.1, but the firewall is configured to drop traffic from 10.10.10.0/24. What is the root cause?

Accepted Answer

The firewall is configured to drop traffic from the source subnet 10.10.10.0/24. Update the firewall policy to allow this traffic.. PBR forwards traffic to the firewall, but the firewall is configured to drop traffic from the source subnet (10.10.10.0/24). This is a policy issue on the firewall, not a routing issue. The solution is to update the firewall policy to allow traffic from the source subnet.

Answer

The next-hop 192.168.1.1 is not reachable from R1 due to a routing issue.

Answer

The route-map on R1 is missing a 'set ip next-hop verify-availability' command, causing it to forward traffic to an unreachable next-hop.

Answer

The VLAN interface on R1 has an ACL that is blocking traffic from 10.10.10.0/24.

Question 3

A network uses PBR to load-balance traffic from two subnets (10.1.1.0/24 and 10.2.2.0/24) across two ISPs (next-hops 100.64.1.1 and 100.64.2.2). After a routing change, traffic from 10.1.1.0/24 is being sent to both ISPs intermittently. Router R1 shows: 'show route-map' shows the route-map with two match clauses, 'debug ip policy' shows traffic from 10.1.1.0/24 being sent to both next-hops. What is the root cause?

Accepted Answer

The route-map has a match clause that matches both subnets, causing traffic to be load-balanced across both next-hops. Use specific ACLs or separate route-map entries.. PBR route-maps can have multiple match clauses, but if the route-map does not have a 'sequence' number or if the match clauses are not mutually exclusive, traffic can match multiple clauses. In this case, the route-map likely has a match clause that matches both subnets (e.g., using a less specific ACL), causing traffic from 10.1.1.0/24 to match both clauses and be load-balanced. The solution is to ensure the ACLs in the route-map are mutually exclusive or use separate route-map entries with sequence numbers.

Answer

The 'set ip next-hop' command is missing the 'load-balance' keyword, causing PBR to use both next-hops by default.

Answer

The routing table on R1 has equal-cost routes to both ISPs, causing PBR to be overridden by the routing table.

Answer

The interface where PBR is applied is in a VRF, causing the route-map to be applied incorrectly.

Question 4

Which statement about PBR and the 'set ip precedence' command is correct?

Accepted Answer

It modifies the IP header of the packet.. The 'set ip precedence' command sets the IP precedence bits in the Type of Service (ToS) field of the IP header, which can be used for QoS classification.

Answer

It sets the DSCP value.

Answer

It can only be used with 'set ip next-hop'.

Answer

It is used for load-balancing.

Question 5

What is the maximum number of VRFs that can be configured on a Cisco IOS router?

Accepted Answer

Platform-dependent, typically limited by available memory.. The maximum number of VRFs is platform-dependent. There is no fixed IOS-wide limit; it varies based on hardware and software resources.

Answer

256

Answer

1024

Answer

Unlimited

Question 6

A network uses PBR to route traffic from a specific host (10.1.1.1) through a VPN tunnel (next-hop 10.10.10.2). After a VPN tunnel failure, traffic from this host is being dropped. Router R1 shows: 'show ip policy' shows PBR applied, 'debug ip policy' shows 'PBR: no route to next-hop 10.10.10.2', but 'show ip route 10.10.10.2' shows a route via a different interface. What is the root cause?

Accepted Answer

The next-hop 10.10.10.2 is not directly connected; it is reachable via a route. PBR requires the next-hop to be directly connected. Use a directly connected next-hop or configure a static route to make it directly connected.. PBR requires the next-hop to be directly reachable (i.e., on a directly connected subnet). If the next-hop is reachable via a route (e.g., through another router), PBR will not use it because it expects a direct connection. In this case, 10.10.10.2 is reachable via a route, not directly connected, so PBR drops the traffic. The solution is to ensure the next-hop is directly connected or use a different next-hop that is directly connected.

Answer

The route-map is missing a 'set ip next-hop verify-availability' command, causing PBR to use the next-hop even when it is not reachable.

Answer

The routing table on R1 has a better route to the destination via the VPN tunnel, overriding PBR.

Answer

The VPN tunnel is down, causing the next-hop to be unreachable.

Question 7

A network uses PBR to route traffic from a specific subnet (172.16.1.0/24) through a WAN link (next-hop 10.10.10.2). After a routing change, traffic from this subnet is being sent to the WAN link but is not reaching the destination. Router R1 shows: 'show route-map' shows the route-map is applied, 'debug ip policy' shows traffic being forwarded to 10.10.10.2, but 'show ip route' on R1 shows a route to the destination via a different next-hop (10.20.20.2). What is the root cause?

Accepted Answer

The next-hop 10.10.10.2 does not have a route to the destination, causing traffic to be dropped. Ensure the next-hop has a route to the destination or use a next-hop that does.. PBR forwards traffic to the set next-hop (10.10.10.2), but the routing table on R1 shows a different route to the destination. This indicates that PBR is overriding the routing table, but the next-hop 10.10.10.2 may not have a route to the destination, causing the traffic to be dropped. The solution is to ensure the next-hop has a route to the destination or use a different next-hop.

Answer

The route-map on R1 is missing a 'set ip next-hop verify-availability' command, causing PBR to use an unreachable next-hop.

Answer

The routing table on R1 has a better route to the destination via 10.20.20.2, but PBR is overriding it incorrectly.

Answer

The ACL in the route-map is matching traffic from the wrong subnet, causing PBR to be applied to the wrong traffic.

Question 8

A network engineer runs the following command to troubleshoot a Policy-Based Routing (PBR) issue:

R1# show route-map PBR-MAP
route-map PBR-MAP, permit, sequence 10
  Match clauses:
    ip address (access-lists): 101
  Set clauses:
    ip next-hop 10.1.1.2
    ip next-hop verify-availability
  Policy routing matches: 100 packets, 12000 bytes

What does this output indicate?

Accepted Answer

PBR is successfully forwarding traffic matching ACL 101 to next-hop 10.1.1.2.. The output shows that 100 packets have matched the route-map and have been policy-routed. This indicates PBR is functioning correctly.

Answer

The next-hop 10.1.1.2 is unreachable.

Answer

The route-map is not applied to any interface.

Answer

The ACL 101 is blocking all traffic.

Question 9

A network engineer is troubleshooting a VRF-Lite configuration where a router is using RIP as the routing protocol in VRF_BLUE. The engineer notices that RIP routes are not being learned from a neighbor router. The 'show ip rip database vrf VRF_BLUE' shows no entries. The 'show ip vrf interfaces VRF_BLUE' shows the correct interface. What is the most likely cause?

Accepted Answer

The 'network' command is configured under the global RIP process, not under the VRF address-family.. RIP in VRF-Lite requires that the RIP process be associated with the VRF and that the network command is issued under the VRF context. Missing the 'address-family ipv4 vrf VRF_BLUE' configuration is a common oversight.

Answer

The 'version 2' command is missing under the VRF address-family.

Answer

The 'no auto-summary' command is missing.

Answer

The 'timers basic' command is set to a very low value.

Question 10

A network uses PBR to route traffic from a specific subnet (192.168.1.0/24) through a WAN link (next-hop 10.10.10.2). After a routing change, traffic from this subnet is being sent to the WAN link but is being dropped. Router R1 shows: 'show route-map' shows the route-map is applied, 'debug ip policy' shows traffic being forwarded to 10.10.10.2, but 'show ip route 10.10.10.2' shows a route via a different interface (GigabitEthernet0/1). What is the root cause?

Accepted Answer

The next-hop 10.10.10.2 is not directly connected to the interface where PBR is applied. PBR requires the next-hop to be directly connected. Use a directly connected next-hop or configure a static route to make it directly connected.. PBR requires the next-hop to be directly connected. If the next-hop is reachable via a route (e.g., through another router), PBR will not use it and will drop the packet. In this case, 10.10.10.2 is reachable via GigabitEthernet0/1, but it is not directly connected to the interface where PBR is applied. The solution is to ensure the next-hop is directly connected or use a different next-hop.

Answer

The route-map is missing a 'set ip next-hop verify-availability' command, causing PBR to use the next-hop even when it is not reachable.

Answer

The routing table on R1 has a better route to the destination via a different next-hop, overriding PBR.

Answer

The interface where PBR is applied is in a different VRF, causing the next-hop to be unreachable.

Question 11

A network engineer runs the following command to troubleshoot a Policy-Based Routing (PBR) issue:

R1# debug ip policy
Policy routing debugging is on
R1#
*Mar  1 00:10:45.456: IP: s=172.16.1.5 (FastEthernet0/0), d=8.8.8.8, len 64, policy match
*Mar  1 00:10:45.456: IP: s=172.16.1.5 (FastEthernet0/0), d=8.8.8.8, len 64, policy routed
*Mar  1 00:10:45.456: IP: FastEthernet0/0 to Serial0/0 10.1.1.2

What does this output indicate?

Accepted Answer

The packet was successfully policy-routed to 10.1.1.2 via Serial0/0.. The debug shows a packet from 172.16.1.5 to 8.8.8.8 that matched the policy and was routed out of Serial0/0 to next-hop 10.1.1.2. This indicates successful PBR operation.

Answer

The packet was dropped due to no matching route.

Answer

The next-hop 10.1.1.2 is unreachable.

Answer

The route-map is misconfigured with wrong ACL.

Question 12

In VRF-Lite, which routing protocols can be used within a VRF?

Accepted Answer

OSPF, EIGRP, RIP, and BGP can all be configured per VRF.. Most routing protocols (RIP, EIGRP, OSPF, BGP) support VRF-aware configurations. The protocol must be configured with the 'vrf' keyword to operate within a specific VRF.

Answer

Only static routing is supported in VRF-Lite.

Answer

Only OSPF and EIGRP are supported in VRF-Lite.

Answer

BGP cannot be used within a VRF in VRF-Lite.

Question 13

A network engineer runs the following command to troubleshoot a Policy-Based Routing (PBR) issue:

R1# debug ip policy
Policy routing debugging is on
R1#
*Mar  1 00:05:23.123: IP: s=192.168.1.10 (FastEthernet0/0), d=10.1.1.100, len 100, policy match
*Mar  1 00:05:23.123: IP: s=192.168.1.10 (FastEthernet0/0), d=10.1.1.100, len 100, policy rejected

What does this output indicate?

Accepted Answer

The packet matched the route-map but was not forwarded due to a failed next-hop check.. The debug output shows a packet from 192.168.1.10 to 10.1.1.100 that matches the policy but is then rejected. This typically occurs when the set clause specifies a next-hop that is unreachable or when verify-availability fails.

Answer

The packet was successfully policy-routed to the next-hop.

Answer

The route-map does not have a match clause for this packet.

Answer

The packet was dropped due to an ACL deny.

Question 14

A network engineer runs the following command to troubleshoot a Policy-Based Routing (PBR) issue:

R1# show ip local policy
Interface   Route-map
local       PBR-LOCAL

What does this output indicate?

Accepted Answer

Local PBR is enabled for packets originated by the router.. The output shows that local PBR is configured using route-map PBR-LOCAL. This applies PBR to locally generated packets on the router.

Answer

PBR is applied to all incoming interfaces.

Answer

The route-map PBR-LOCAL is not configured.

Answer

PBR is applied to all outgoing interfaces.

Question 15

A network engineer runs the following command to troubleshoot a Policy-Based Routing (PBR) issue:

R1# debug ip policy
Policy routing debugging is on
R1#
*Mar  1 00:15:30.789: IP: s=10.0.0.1 (FastEthernet0/0), d=20.0.0.1, len 100, policy match
*Mar  1 00:15:30.789: IP: s=10.0.0.1 (FastEthernet0/0), d=20.0.0.1, len 100, policy rejected
*Mar  1 00:15:30.789: IP: s=10.0.0.2 (FastEthernet0/0), d=20.0.0.2, len 100, policy match
*Mar  1 00:15:30.789: IP: s=10.0.0.2 (FastEthernet0/0), d=20.0.0.2, len 100, policy routed
*Mar  1 00:15:30.789: IP: FastEthernet0/0 to GigabitEthernet0/1 192.168.1.1

What does this output indicate?

Accepted Answer

The route-map has multiple sequences or ACL entries; one source is permitted, the other is denied or fails next-hop check.. The debug shows two packets: the first from 10.0.0.1 was rejected, while the second from 10.0.0.2 was successfully routed to 192.168.1.1. This suggests that the route-map may have multiple sequences or the ACL differentiates between the sources.

Answer

Both packets should have been rejected due to a misconfiguration.

Answer

The next-hop 192.168.1.1 is unreachable for the first packet.

Answer

The ACL is blocking all traffic from 10.0.0.1.

Question 16

Which statement about PBR and the 'set interface' command is correct?

Accepted Answer

The 'set interface' command forces the packet out the specified interface, and if the interface is down, the packet is dropped.. The 'set interface' command forces the packet out a specific interface, overriding the routing table. If the interface is down, the packet is dropped unless a fallback is configured.

Answer

The 'set interface' command can only be used with point-to-point interfaces.

Answer

If the specified interface is down, the router uses the routing table.

Answer

The 'set interface' command requires a next-hop IP address to be specified.

Question 17

Drag and drop the steps to troubleshoot Policy-Based Routing (PBR) adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Verify PBR application on interface (show ip policy). Start by checking if PBR is applied on the correct interface. Then verify the route map sequence and match statements. Check the set next-hop reachability via routing table. Use 'debug ip policy' to see packet matches. Finally, test with extended ping or traceroute to confirm path.

Question 18

Which TWO statements about PBR and the 'set ip next-hop recursive' command are true? (Choose TWO.)

Accepted Answer

The 'set ip next-hop recursive' command can specify a next-hop address that is not directly connected, and the router will perform a recursive lookup to determine the outgoing interface.. The 'set ip next-hop recursive' command allows PBR to use a next-hop address that is not directly connected; the router performs recursive lookup to find the outgoing interface. This is different from 'set ip next-hop' which requires a directly connected next hop. The recursive option is useful when the next hop is multiple hops away. However, it can impact performance due to the recursive lookup.

Answer

The 'set ip next-hop recursive' command is the default behavior for 'set ip next-hop' when the next hop is not directly connected.

Answer

The 'set ip next-hop recursive' command is only supported on Cisco IOS-XE platforms, not on classic IOS.

Answer

When using 'set ip next-hop recursive', the router will drop the packet if the recursive lookup fails to find a route to the next hop.

Question 19

A network engineer runs the following command to troubleshoot a Policy-Based Routing (PBR) issue:

R1# show route-map PBR-MAP
route-map PBR-MAP, permit, sequence 10
  Match clauses:
    ip address (access-lists): 101
  Set clauses:
    ip next-hop 10.1.1.2
  Policy routing matches: 50 packets, 6000 bytes

What does this output indicate?

Accepted Answer

PBR is successfully forwarding matching traffic to 10.1.1.2.. The output shows that 50 packets have matched the route-map and have been policy-routed to next-hop 10.1.1.2. This indicates PBR is working.

Answer

The next-hop 10.1.1.2 is not reachable.

Answer

The ACL 101 is misconfigured.

Answer

PBR is not applied to any interface.

Question 20

An engineer configures PBR on a router to route traffic from VLAN 10 to next-hop 192.168.1.2 using a route-map. The route-map is applied inbound on the VLAN interface. The engineer also configures 'ip policy route-map' on the same interface. However, traffic from VLAN 10 is not being policy-routed; instead, it is forwarded normally. The router is running IOS-XE. What is the most likely cause?

Accepted Answer

The VLAN interface is a Layer 2 switch virtual interface (SVI) and does not support PBR without additional hardware configuration.. On IOS-XE, PBR is not supported on switched virtual interfaces (SVIs) by default; it requires the 'platform hardware throughput mode' or specific hardware support. Alternatively, the interface may be a Layer 2 switch port, not a routed interface. PBR only works on routed interfaces.

Answer

The route-map is missing a 'match ip address' clause.

Answer

The next-hop 192.168.1.2 is not reachable via any route.

Answer

The 'ip policy route-map' command is applied outbound instead of inbound.